Method and apparatus for detecting cyber threats

A computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method of heuristically identifying a cyber threat at the computer, the method comprising:

• serving a collection of reinforced cookies for storage during a first communication session with a first client computing device;
• receiving a request for a second communication session from a second client computing device purporting to be the first client computing device;
• and
• comparing a configuration of reinforced cookies on the second client computing device to configurations indicative of one or more cyber threats;
• wherein each said reinforced cookie in the collection of reinforced cookies is generated from a unique identifier associated with a user of the first client computing device;
• and
• wherein each said reinforced cookie comprises one or more of:
• an HTTP (Hyper Text Transport Protocol) cookie;
• a history cookie;
• and
• a cache cookie.

An apparatus for detecting a cyber threat on a client computing device, the apparatus comprising:

• a web server configured to serve electronic content to client computing devices;
• a cookie generator configured to generate a collection of reinforced cookies for storage on a client computing device, including one or more of:
• a reinforced HTTP (Hyper Text Transport Protocol) cookie;
• a reinforced history cookie;
• and
• a reinforced cache cookie;
• and
• a heuristic analysis engine configured to compare a configuration of reinforced cookies detected on a client computing device with configurations indicative of cyber threats.